Loading story…
Researchers uncovered xlabs_v1, a Mirai-derived botnet that compromises internet-exposed Android and IoT devices with ADB enabled on TCP port 5555 and repurposes them for DDoS-for-hire attacks, with a strong focus on Minecraft and other game servers. Hunt.io traced the operation to bulletproof-hosted infrastructure in the Netherlands, including an exposed server at 176.65.139[.]44 and a control panel tied to xlabslover[.]lol. The malware drops a bot binary into /data/local/tmp/, disguises itself as /bin/bash, decrypts configuration data with ChaCha20, and communicates with command-and-control over TCP port 35342. Analysts also found an embedded operator handle, "Tadashi," though attribution remains unconfirmed.
The botnet supports 21 flood methods across TCP, UDP, and raw protocols, including a RakNet flood capability tailored to disrupt Minecraft services, and it even serves its bot binary over TCP port 25565, the default Minecraft server port. Hunt.io said the malware profiles victim bandwidth by opening 8,192 parallel TCP sockets to nearby Speedtest servers, likely to sort infected devices into service tiers for customers. The malware also includes a built-in killer to remove competing malware and a fallback access path on TCP port 26721, but it lacks persistence and must reinfect devices through the same exposed ADB route. Separately, Darktrace reported threat actors abusing a deliberately misconfigured Jenkins honeypot to deploy another DDoS botnet, underscoring continued targeting of gaming-related infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Further reporting said the botnet supports 21 flood methods across TCP, UDP, and raw protocols, lacks persistence, and reinfects devices through repeated ADB exploitation. The report also noted attribution remained limited to the embedded handle “Tadashi.”
Analysis showed xlabs_v1 compromises internet-exposed Android and IoT devices with ADB enabled on TCP port 5555, then uses them in a DDoS-for-hire operation aimed largely at Minecraft and other game servers. Researchers also identified tailored capabilities including RakNet flooding, competitor malware killing, bandwidth profiling, and C2 communications with xlabslover[.]lol over TCP port 35342.
Hunt.io identified a new Mirai-based botnet operation, xlabs_v1, after finding exposed tooling and an unauthenticated directory on Netherlands-hosted infrastructure tied to Offshore LC. The exposed assets revealed binaries, payloads, proxy credentials, and operational details about the botnet.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourceblog.ostorlab.co
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Mirai** malware turned insecure internet-connected devices into massive DDoS botnets that powered some of the largest attacks publicly reported, including floods against **OVH**, **KrebsOnSecurity**, and DNS provider **Dyn**. The botnet spread by logging into exposed IoT devices such as cameras, DVRs, routers, and gateways with hardcoded or default credentials, and defenders later warned that products including certain **Sierra Wireless AirLink** gateways could be conscripted if factory passwords were left unchanged. After the malware’s source code was released publicly under the alias **"Anna-senpai"**, multiple actors were able to build copycat botnets, increasing attack volume and complicating attribution. The Dyn attack disrupted access to major online services including **Twitter, Spotify, Reddit, GitHub, Airbnb, Shopify, SoundCloud, and The New York Times**, with Dyn describing a highly distributed, adaptive campaign delivered in several waves from vast numbers of IP addresses. Investigative reporting tied Mirai’s origins to the DDoS-for-hire and Minecraft-hosting ecosystem and presented evidence linking the **Anna-senpai** persona to **Paras Jha** and associates, while later reporting showed Mirai variants continued launching attacks long after the original incidents. Researchers identified limited countermeasures, including crashing some bots via a flaw in Mirai’s HTTP flood code and traceback methods for DNS amplification traffic, but the broader risk persisted because vulnerable IoT devices remained widely deployed and malware authors could quickly adapt.
Jun 29, 2026
Researchers reported that the **Masjesu** botnet, also tracked as **XorBot**, has been operating since early 2023 as a **DDoS-for-hire** service promoted on Telegram. The malware targets internet-exposed routers, gateways, cameras, DVRs, NVRs, and other embedded devices across multiple CPU architectures, exploiting known command-injection and remote code execution flaws in products from vendors including **D-Link, Huawei, NETGEAR, TP-Link, and GPON**. Trellix said the botnet is engineered for stealth and longevity, using XOR-based obfuscation, runtime decryption, persistence mechanisms, process spoofing, and multi-domain command-and-control infrastructure with fallback IPs. Once installed, Masjesu opens a hard-coded TCP port `55988` for direct operator access, suppresses termination signals, kills utilities such as `wget` and `curl`, and connects to external servers for attack instructions. The operators reportedly avoid scanning or infecting high-profile ranges such as **U.S. Department of Defense** networks to reduce scrutiny, while advertising the botnet's geographic spread and attack capacity. Observed traffic has been concentrated in **Vietnam** and also seen from **Ukraine, Iran, Brazil, Kenya, and India**, with the botnet used to launch **TCP, UDP, and HTTP flood** attacks against CDNs, game servers, and enterprises, including volumes reported at roughly **290 Gbps**.
Jun 29, 2026
Fortinet and other reporting identified **Nexcorium**, a Mirai-derived malware strain targeting Internet of Things devices, particularly **TBK DVR-4104** and **DVR-4216** video recorder systems used with security cameras. The campaign exploits **`CVE-2024-3721`**, an OS command injection flaw, to run a downloader script that retrieves malware binaries for multiple Linux architectures. Fortinet linked the activity to a suspected actor it calls **Nexus Team**, citing the custom HTTP header `X-Hacked-By: Nexus Team – Exploited By Erratic.` Once installed, Nexcorium uses classic Mirai-style scanner, watchdog, and attack modules, establishes persistence through mechanisms including init, `rc.local`, systemd, and cron, and spreads further through brute-force Telnet activity, default-password abuse, and exploitation of **`CVE-2017-17215`** in Huawei HG532 devices. The malware performs self-checks, replication, and self-deletion to improve resilience and evasion, then connects to the command-and-control domain `r3brqw3d[.]b0ats[.]top` to receive instructions for **DDoS** operations, including UDP, TCP SYN, TCP ACK, SMTP, and VSE query floods.
Jun 29, 2026